What Have We Found in Git Repos?
summary
Public Git histories frequently reveal security fixes well before advisories: tooling that cloned and parsed repos across roughly 1,500 projects correlates commit metadata with CVE/OSV entries, reconstructs timelines, and flags indicators like branch names, “security” language, or rapid merge activity. Analysis finds many fixes land days or weeks before public advisories (median 10 days, average skewed to months), and recent work shows AI-generated proof-of-concept exploits can be produced from those commits, so attackers can automate large-scale monitoring and exploit generation.
AI-written summary · about
chapters (18)
- 0:00Missed security update research
- 1:52Metadata in Git repos
- 3:35Commit dates and security timelines
- 5:01Deleting commits from public repos
- 7:12CVEs to Git commits
- 13:021,500 repos security analysis
- 17:50Fixes vs CVE timelines
- 20:25Spotting security fixes early
- 22:40Best practices for security releases
- 26:14Downstream dependency updates
- 27:22Q&A: Publishing fixes
- 30:15Q&A: CVE-commit automation
- 31:42Q&A: Safer open source commits
- 32:52Q&A: Linux kernel analysis
- 33:57Q&A: Old bug fixes relevance
- 36:49Q&A: AI in vulnerability handling
- 37:56Q&A: Exploits vs software fixes
- 39:03Closing remarks
related talks
16mPerformance improvements: exposing hidden security fixes in Open Source
54mSecurity Holes in Git
31mA Glimpse Into OSS Vulnerability Disclosure Practices
39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE Remediation
30mSecuring the software supply chain together
30mHidden Vulnerabilities in Open Source
38mCode Security Reinvented: Navigating the era of AI
24mBuilding a Better Database: How GitHub Structures Their Advisory Database to Drive Developer ...